---
title: "Limitations and Cautions"
canonical: "https://docs.infoblox.com/space/DeploymentGuideDNSInfrastructureProtection/1870692364/Limitations%20and%20Cautions"
format: markdown
---
- Grid Masters in Grid deployments cannot run the DNS Infrastructure Protection service. They are only responsible for updating rulesets.
- Standalone deployment does not support Infoblox HA (VRRP-based High Availability).
- Protected interfaces (LAN1 and LAN2) are limited to DNS and DHCP traffic, protocols in support of DNS anycast (BGP and OSPF) and the standard IP protocols such as ICMP, as well as connections to NTP servers.
- The MGMT interface is used for other traffic, such as Grid, SSH, SNMP, NTP, and it will not be protected by DNS Infrastructure Protection.
- You cannot run other services, such as FTP, TFTP, and HTTP, on the advanced appliance.
  - The appliance terminates TCP connections for incoming DNS requests after handling the initial request through each TCP connection. The exception for this default Grid setting is for an SOA query sent by a client that is accepted in the allow-transfer ACL. In the case of an SOA query, the TCP connection remains open for subsequent DNS requests. This exception also covers the case in which an AXFR query follows the SOA query through the same TCP connection.

## Cautions

**Stateful Firewalls**

Under volumetric (high PPS), stateful firewalls need to be sized appropriately. Some types of UDP DNS attacks may not have responses, which may lead to resource starvation in the firewall. Consider that 1GbE ~ 1.4 Mpps, and 10GbE ~ 14 Mpps. To prevent issues with firewalls, the LAN1/LAN2 interfaces of DNS Infrastructure Protection servers should be in front of any stateful firewalls so that as DNS Infrastructure Protection is not affected by these issues. This can also affect the recursion path.

**Low performance network elements (PPS)**

DNS is a UDP protocol whose typical query packet size is 80-90 bytes. When faced by a line-rate volumetric attack with these DNS packets, some firewalls/switches/routers are unable to cope and may reset or provide substandard performance.

**Use of MGMT, LAN1, and LAN2**

Whilst it is now possible (as of 8.1) to use LAN1 for management, it is considered a poor design choice since under volumetric attack, you may lose access to the Infrastructure Protection member, and the customer must accept any/all possible repercussions including loss of reporting data, logging data, disconnection from Grid, failure of Infrastructure Protection Updates, failure to upgrade et al.

When you disable **Enable VPN on MGMT Port **setting, upon saving the following pop up is going to appear.  
This is a warning to be taken seriously.

![image-20251201-100820.png](media://e3b18c10-078f-4090-bd44-192c2c10db22)